/**
 * A Google service-account access token, without the SDK.
 *
 * Vertex will not take an API key. It wants an OAuth access token, and the only
 * way to get one unattended is the two-legged flow: build a JWT, sign it with
 * the service account's private key, and trade it at the token endpoint.
 * `google-auth-library` is ninety-odd packages to do that; this library has zero
 * runtime dependencies and a test that fails the build if one appears, because
 * every dependency is somebody else's code reading your prompts.
 *
 * WebCrypto rather than `node:crypto`, so the browser-safe entry point stays
 * browser-safe. `RSASSA-PKCS1-v1_5` with SHA-256 is what Google calls RS256.
 */
/**
 * PEM to the DER bytes `importKey` wants.
 *
 * The header, the footer and every newline come out. A PEM that still has them
 * fails inside WebCrypto with `DataError`, which says nothing about which of the
 * fourteen things that can be wrong with a key is wrong with this one.
 */
export declare function pkcs8FromPem(pem: string): ArrayBuffer;
export interface ServiceAccount {
    client_email: string;
    private_key: string;
    token_uri?: string;
}
/**
 * The assertion Google trades for a token.
 *
 * Exported so a test can read it: this is the document where a wrong `aud`, a
 * clock an hour out, or a scope nobody granted turns into `invalid_grant`, an
 * error message that names none of the three.
 */
export declare function signedJwt(account: ServiceAccount, scope: string, now: Date): Promise<string>;
export interface CachedToken {
    token: string;
    /** Epoch seconds. */
    expiresAt: number;
}
/**
 * Trades the assertion for an access token, caching until shortly before expiry.
 *
 * The cache is the point. A token lasts an hour and `optimize --suggest` over a
 * directory makes one call per prompt: fetching a token each time turns forty
 * prompts into eighty requests, half of them to an endpoint that rate-limits.
 *
 * Sixty seconds of margin, because a token that expires in flight fails the
 * request it was fetched for, and the clock here is not the clock there.
 */
export declare function accessToken(account: ServiceAccount, options?: {
    scope?: string;
    fetchImpl?: typeof fetch;
    now?: () => Date;
    cache?: {
        current: CachedToken | null;
    };
}): Promise<string>;
//# sourceMappingURL=gcp-auth.d.ts.map